Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have simple jsp-site on tomcat. To work with session I use simple jsp session object.

But I need some sessions isolation in my web directories e.q.

mysite.com/dir1 
mysite.com/dir2

I want to use independent sessions for each dir1 and dir2

It's possible with minimal jsp-code correction and without using of virtual hosts?

share|improve this question
    
Are dir1 and dir2 different applications or different path in a single application ? –  ixe013 Jun 28 '12 at 4:04
    
@ixe013 it's a single application –  triclosan Jun 28 '12 at 7:46
add comment

2 Answers

Tomcat offerts some control over the session cookie's path with the sessionCookiePath context parameter, but not enough for your needs. I beleive you can play fast and loose with both the server (servlet container) and the browser with very little code.

In short, write a servlet filter that let the request in, unchanged. When the response comes out, add your servlet path to the JSESSIONID cookie path and let the browser send a different JSESSIONID (thus using a different session) for each servlet.

Here is how it works :

  1. When a request comes in the first time, it is "naked", it does not have any cookies associated with it. It does not have a session.
  2. The server will create one and associate a JSESSIONID to it and add a cookie to let the client do its part of the tracking.
  3. The client is still waiting on its initial request at this point.
  4. In the servlet filter (or mod_rewrite) add the servlet path to the cookie's path.
  5. Send the response to the client.

With the cookie personalized for servlet /dir1, when the browser will send a request to /dir2, it will also be "naked", no cookies whatsoever. A new session will be created, the filter will add the path to it and so on...

From the server's point of view, there are two clients (with the same IP). One is always using /dir1 servlet and the other is only using /dir2 servlet. Nothing wrong with that.

Here is one filter implementation that can give a head start. You might also consider doing it in Apache with mod_headers.

share|improve this answer
add comment

The question is why you want to do this.

If it's security-related you should deploy dir1 and dir2 as different servlets. Different servlets have different sessions, so your problem should be solved.

If that is not an option, and your motivation hasn't anything to do with security, you could add a map for each path to your session. You would then have to access your session objects first by obtaining the map for the path, then accessing the session object (i.e. ${session.dir1.foo}).

A third solution might be to use a filter to hide certain elements in the session for the current request by creating a HttpServletRequestWrapper which returns a special HttpSession for different requests.

share|improve this answer
    
Thank you for this answer. How deploy servlets separately within one virtual host. –  triclosan Jun 26 '12 at 21:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.